Mac Address and Network Interface
Can Wireshark automatically extract the Network Interface Card vendor from the MAC address alone? How is this possible?
Can Wireshark automatically extract the Network Interface Card vendor from the MAC address alone? How is this possible?
The first three octets of the MAC address (if not locally assigned) are the vendor code, Wireshark uses an internal list compiled from a number of sources, see the header of the manuf file.
To add some detail to this: Ethernet NIC manufacturers must acquire ranges of MAC addresses that they are allowed to use. E.g., if I wanted to sell Ethernet NICs I'd have to request a range of MAC addresses which I could use in my NICs.
This MAC address range -> Vendor information is publicly available; Wireshark gathers this publicly available information into the manuf
file Graham mentioned.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2021-03-16 18:56:21 +0000
Seen: 535 times
Last updated: Mar 17 '21